upgrade the guava version

[Nanmozhi22]

Upgrade com.google.guava:guava to fix 2 Dependabot alerts in qa/large-data-tests/pom.xml
Upgrade com.google.guava:guava to version 32.0.0-android or later. For example:

com.google.guava guava [32.0.0-android,)

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

[Nanmozhi22]

I will work on this issue

[psavidis]

Hello @Nanmozhi22,
Thank you for the interest to work on this item.

In order to qualify this item, could you please post in the ticket thread:
a) the depentabot alerts mentioned in the ticket description
b) the vulnerability

Thanks,
Petros

[Nanmozhi22]

Hello @psavidis

Here are the details which I got from the dependent bot , pls let me know

Description :

Upgrade com.google.guava:guava to version 32.0.0-android or later. For example:

com.google.guava guava [32.0.0-android,)

Vulnerability details :

A temp directory creation vulnerability exists in Guava prior to version 32.0.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. Maintainers recommend explicitly changing the permissions after the creation of the directory, or removing uses of the vulnerable method.

[psavidis]

@Nanmozhi22

Is cve-2020-8908 the one you posted on the ticket?

[Nanmozhi22]

Hi @psavidis

yes correct that is one :

CVE ID
CVE-2020-8908

[psavidis]

Hello @Nanmozhi22,

Apologies for the late response. This item has been of low criticality and due to heavy load i didn't manage to provide an answer earlier. However, here are a few notes i'd like to make:

• Reported Module: The qa/large-data-tests module belongs to the test suite and is not part of the production code.
• Vulnerability Severity: The vulnerability of Guava is of low criticality (it has received a score of 3.3/10), especially given the fact it is found only in the test suite which is rather isolated and hard for an attacker to make use of the vulnerability.
• Guava version: The version suggested in your PR uses bounds and an android version of guava. The suggestion looks a bit generic to me. I couldn't find any other usage of dependency using a range syntax in the whole project neither i personally find it a best practice to have an implicitly calculated version instead of an explicit one.
• The same version is used in the unit tests of the engine.

Given the above, i recommend to skip this request at this point as not needed as
a) it would require more investment effort to check its correctness than the benefits it provides
b) the scope is not critical

Thank you for your interest to contribute 👍

KR,
Petros